ALZ v Lismore City Council
[2013] NSWADT 154
•08 July 2013
Administrative Decisions Tribunal
New South Wales
Medium Neutral Citation: ALZ v Lismore City Council [2013] NSWADT 154 Hearing dates: On the papers Decision date: 08 July 2013 Jurisdiction: General Division Before: S Montgomery, Judicial Member Decision: 1. The matter is remitted for further consideration by the Respondent pursuant to section 65 of the Administrative Decisions Tribunal Act 1997.
2. The further consideration is to be completed within 60 days from the date of these reasons.
3. The matter is listed for a further planning meeting at 10 am on Tuesday 10 September 2013.
Catchwords: Privacy and Personal Information - jurisdiction - whether internal review application out of time. Legislation Cited: Administrative Decisions Tribunal Act 1997
Privacy and Personal Information Protection Act 1998Category: Interlocutory applications Parties: ALZ (Applicant)
Lismore City Council (Respondent)Representation: ALZ (Applicant in person)
R Massif, (Agent for Respondent)
Privacy Commissioner
File Number(s): 133039
reasons for decision
GENERAL DIVISION (S MONTGOMERY, (JUDICIAL MEMBER)): In these reasons the name of the Applicant has been anonymised so as to preserve the privacy of her personal affairs. The Applicant is referred to as ALZ. I have also limited my discussion of the evidence in order to avoid the possibility that the identities of individuals might be revealed.
ALZ is seeking review by the Tribunal under the provisions of the Privacy and Personal Information Protection Act 1998 ("the PPIP Act") in relation to alleged conduct by the Respondent. The conduct is alleged to have occurred on separate occasions in February 2012 ("the February conduct") and August 2012 ("the August conduct").
The Respondent contends that the Tribunal has no jurisdiction to hear and determine ALZ's application. In relation to the February conduct it asserts that ALZ failed to make her application for internal review under the PPIP Act within the time prescribed in that Act. The Respondent has also raised the issue of the scope of the application to the tribunal and that it concerns matters that were not the subject of the internal review application.
ALZ contends that she did make her internal review application within the prescribed time and even if it was made outside the prescribed time (which was not admitted) the Respondent had accepted her internal review request and having accepted the request the Respondent was bound to deal with the request. ALZ further contends that as the Respondent failed to determine the request within the prescribed time this gave rise to the Tribunal having jurisdiction to hear and determine her application.
The question as to whether the Tribunal has jurisdiction to hear and determine ALZ's application is to be determine as a preliminary issue.
The relevant legislation
The Tribunal's jurisdiction to hear and determine an application in regard to conduct of an agency is pursuant to section 38 of the Administrative Decisions Tribunal Act 1997 ("the ADT Act") and section 55 of the PPIP Act.
Section 55(1) of the PPIP Act provides:
"55 Review of conduct by Tribunal
(1) If a person who has made an application for internal review under section 53 is not satisfied with:
(a) the findings of the review, or
(b) the action taken by the public sector agency in relation to the application,
the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.
Section 53(1) of the PPIP Act gives a person who is aggrieved by the 'conduct of a public sector agency a right to make an application to seek review of that conduct'. The term 'conduct' is defined in section 52(1) of the PPIP Act. It includes 'conduct' that is a 'contravention by a public sector agency of an information protection principle that applies to the agency'.
The term 'information protection principle' is defined in section 3 of the PPIP Act to mean the provisions set out in Division 1 of Part 2 of that Act: see sections 8 to 19 of the PPIP Act. These provisions provide for the manner in which a public sector agency is to collect, store, secure, use and disclose personal information.
Section 53 of the PPIP Act provides:
53 Internal review by public sector agencies
...
(3) An application for such a review must:
(a) be in writing, and
(b) be addressed to the public sector agency concerned, and
(c) specify an address in Australia to which a notice under subsection (8) may be sent, and
(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and
(e) comply with such other requirements as may be prescribed by the regulations.
(4) Except as provided by section 54 (3), the application must be dealt with by an individual within the public sector agency who is directed by the agency to deal with the application. That individual must be, as far as is practicable, a person:
(a) who was not substantially involved in any matter relating to the conduct the subject of the application, and
(b) who is an employee or officer of the agency, and
(c) who is otherwise suitably qualified to deal with the matters raised by the application.
(5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by:
(a) the applicant, and
(b) the Privacy Commissioner.
(6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for a review of the conduct concerned.
(7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following:
(a) take no further action on the matter,
(b) make a formal apology to the applicant,
(c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant),
(d) provide undertakings that the conduct will not occur again,
(e) implement administrative measures to ensure that the conduct will not occur again.
...
Issues
This preliminary application raises two issues:
(a) did ALZ make her application for review within the prescribed time as required under paragraph 53(3)(d) of the PPIP Act? or
(b) did the Respondent allow for a later date as provided for by paragraph 53(3)(d)?
Each issue is ultimately a question of fact. If either is answered in the affirmative the Tribunal will have jurisdiction to hear and determine ALZ's application for review.
Background
The Respondent received ALZ's 'Privacy Complaint: internal review application form' ("the privacy complaint") on 17 October 2012. In the privacy complaint ALZ referred to the February conduct and the August conduct. She stated that she first became aware of the February conduct in March 2012 and of the August conduct in August 2012.
In an statement dated 17 April 2013 ALZ stated in relation to the February conduct:
On April 23, I raised the matter with Council as a grievance.
I did not know that I was entitled to make a privacy complaint and that I could apply to Council for an internal review of the conduct.
On October 15 I phoned the Office of the Privacy Commissioner. I spoke to an officer who explained the procedure to me.
In the privacy complaint ALZ also stated:
I am asking for a late application because: I have previously complained about the February breaches under the grievance procedures. I did this because I did not know I had a right under the privacy legislation to make a complaint. I learnt that a request for internal review is available to me on Monday 15th October, when I telephoned the privacy commissioner.
The Respondent's Manager, Human Resources wrote to ALZ on 12 November 2012. The letter stated:
Dear [ALZ]
Privacy Complaint: Internal Review Application Form
Thank you for your privacy complaint, internal review application form dated and received 17 October 2012.
To manage this application for an internal review, Council is following an internal review checklist as provided on the website of the Office of the Privacy Commissioner.
It is understood your application for review of conduct is under s53 of the Privacy and Personal Information Protection Act 1998 (PPIP Act). The conduct you are requesting a review of is as follows:
1.Alleged disclosure of private and confidential information from your employment records to colleagues, a cleaner and your Solicitor, without your knowledge or consent.
2.Alleged defamation of character contained within a document and disclosure to StateCover, without your knowledge or consent.
Council will conduct an independent internal review under s53 of the PPIP Act. Graeme Wilson, Corporate Compliance Coordinator, will complete the review and Graeme may be contacted by ...
It is estimated the review may take up to four weeks to complete from this date and the outcome will be provided by 14 December 2012. Should the review not be completed by 16 December 2012 (this date is 60 days from the date the application or privacy complaint was first lodged), as a complainant you have an option to go to the Administrative Decisions Tribunal without waiting for the results of this review.
Please note a copy of this letter will be provided to the NSW Privacy Commissioner for their oversight role.
...
Ms Fran Summerfield, a Human Resources Officer with the Respondent, wrote to ALZ by email on 14 December 2012. In her email Ms Summerfield wrote:
Subject:Update on Status of Internal Review Process - Privacy Complaint
Dear [ALZ]
Following advice provided to you in Council's letter dated 12 November 2012, the purpose of this email is to provide you with an update on the progress to date of the privacy complaint: internal review received from you dated 17 October 2012.
Please note that as per the process identified in the internal review checklist, a copy of the draft findings of the internal review outcome has now been provided to the Office of the Privacy Commissioner NSW for their consideration. In the letter to you dated 12 November 2012, Council advised that it was estimated the review may take up to four weeks to complete and an outcome would be provided by 14 December 2012.
The purpose of this notification is to advise you that a response will unfortunately not be provided today, as previously indicated. The Review Officer is following due process (the internal review checklist for Agencies) and the correct procedure is to consider any response from the Privacy Commissioner Office prior to issuing a response on the findings to you.
If you have any questions in regards to this process or should you wish to discuss any aspect of this, please do not hesitate to contact Council. I would expect a response could be provided to you as soon as the Office of the Privacy Commissioner has provided comments or a submission.
As advised in the letter to you dated 12 November 2012, should the review not be completed by 16 December 2012, then you have the option to go to the Administrative Decisions Tribunal without waiting for the results of this review. ...
Please note a copy of this communication will be provided to the Office of the Privacy Commissioner, for their records.
ALZ lodged an application for review with the Tribunal. Her application was dated 24 January 2013 but was accepted as filed with the Tribunal on 14 February 2013.
On 5 February 2013, Mr Graeme Wilson, the Respondent's Corporate Compliance Coordinator, wrote to ALZ. In relation to that part of the privacy complaint concerning the February conduct Mr Wilson noted that the Respondent would not be accepting ALZ's late application. He stated:
Lismore City Council (Council) received your privacy complaint on 17 October 2012, seeking an internal review of conduct under s53 of the Privacy and Personal information Protection Act 1998 (PPIP Act). Your complaint was acknowledged and the process explained to you in a letter dated 12 November 2012. Further, Council provided an update to you on 14 December, advising that a copy of the draft findings of the internal review had been provided to the Office of the Privacy Commissioner NSW for their consideration.
It is understood you are seeking a review of conduct relating to two unrelated matters. The first matter relates to the alleged disclosure of private and confidential information from your employment records and the content and use of a document used in disciplinary matters.
The second matter refers to alleged disclosure of personal information from your employment records to your instructed Solicitor.
In accordance with s53(3)(d) of the PPIP Act, Council will not be accepting your late application on the first matter. More than six months has lapsed between the date you first became aware of the alleged conduct and when the application for internal review was lodged. This matter was raised as part of an investigation by an independent external investigator and the findings provided in August 2012. There was no finding of inappropriate action by the person identified in your complaint.
The focus of the internal review relating to the second matter was to determine whether privacy laws had been breached by Council in relation to the collection and use of your personal or health information. Council has followed due process in this matter by completing an internal review checklist and reviewing a number of source reference material ...
Mr Wilson indicated that the Respondent had conducted an internal review in regard to the August conduct and he gave ALZ his findings.
As noted above, the Respondent contends that the Tribunal has no jurisdiction to hear and determine ALZ's application in relation to the February conduct.
The Respondent's contention
The Respondent submits that there are two grounds that preclude ALZ's application from the jurisdiction of the Tribunal. They are:
(a) The out of time component pursuant to section 53(3)(d) of the PPIP Act; and
(b) The issues identified in the application to the Tribunal are different to those identified in the application to Council for an internal review.
The Out Of Time Argument
The Respondent submits that the Tribunal must be satisfied that the application for internal review was lodged with the Respondent within 6 months from the time that ALZ became aware of:
(a) the conduct alleged to have occurred in February 2012; and
(b) the legal significance of the alleged conduct in the context of ALZ's rights under the PPIP Act.
It is common ground that ALZ became aware of the February conduct in either late March or early April 2012. ALZ's evidence is that she was not aware of the legal significance of the conduct until October 2012.
The Respondent submits that the Tribunal should not accept ALZ's evidence as to when she first became aware of the legal significance of the alleged conduct. Nor should the Tribunal accept her claim that she did not know that she was entitled to apply for an internal review of the conduct.
ALZ had filed at least two other applications for internal reviews. One of those applications was made on 23 July 2012 - some 3 months prior to when she made the privacy complaint on 17 October 2012. The Respondent submits that those internal review applications suggest that, prior to 15 October 2012 and contrary to her evidence, ALZ was aware that she was entitled to make a privacy complaint and that she could apply to the Respondent for an internal review of the conduct.
The Respondent further contends that given the significance of ALZ's evidence, she has failed to adduce all relevant evidence. Pertinent questions that remain unanswered include but are not limited to:
a)What advice was ALZ afforded by her legal representatives in August 2012 in relation to her rights under the Act?
b)If ALZ's legal representatives failed to advise her of her rights under the Act why is there no evidence being led to that effect?
c)What prompted ALZ to contact the Privacy Commissioner on 15 October 2012?
d)How if at all does ALZ reconcile her claim at 11 of her evidence that she did not know that she could apply to Council for an internal review, with the fact that she applied to Council for internal reviews in July and September 2012?
ALZ's response
As noted, ALZ's evidence is that she phoned the Office of the Privacy Commissioner on 15 October 2012. In submissions filed on 24 June 2013 she responded to the Respondent's contentions in relation to the issue of her awareness. She stated:
In the matter of the factual dispute about whether I was aware of both the conduct and my entitlement to apply for an internal review, I ask the Tribunal to consider, in addition to the submissions I have previously filed, the following points.
My late application was caused by the incorrect information given to me by Council's human resources manager, i.e. that employee records were exempt from the Privacy Act. It is very unfair that Council have ignored their role in causing the late application, while maintaining that I was aware of my rights and implying that I am a liar.
As further proof that my knowledge of the processes of making applications for internal and external review of conduct was very limited, I have attached my September 26, 2012 application to the Tribunal for review of conduct.
This form shows I did not have sufficient knowledge to complete the form and was seeking legal advice. I subsequently went through the phone book looking for a solicitor who could advise me on privacy legislation and found no-one.
On October 15 my union organiser advised me that employee records were covered by privacy laws and I made my application to Council for internal review on October 17.
I did not elaborate on this point in my initial submission because I did not anticipate that Council would attack me for heeding their advice to me in the internal review response, that employee records were exempt.
In light of the above points and my previous submissions I ask the Tribunal to find that I was unaware of my entitlement to apply for an internal review, and that the Tribunal has the jurisdiction to review the conduct concerned.
ALZ's reference to 'incorrect information given to me by Council's human resources manager' appears to be a reference to the following statement in a letter dated 3 August 2012 from the Respondent's Manager Human Resources:
... under the compulsion of law, Council produced relevant documents and considers there is no breach of privacy.
In addition, there is an exemption for an employer regarding employee records under section 7B(3) of the Privacy Act and an exemption under Schedule 3 of the National Privacy Principles for disclosure in accordance with a legal obligation.
Privacy Commissioner's submissions
The Privacy Commissioner appeared in the proceedings pursuant to her right to appear and be heard under section 55(6) of the PPIP Act. Ms Kathryn Luis provided detailed submissions on behalf of the Privacy Commissioner. However, she noted:
... the Privacy Commissioner does not propose to address whether the applicant's request for internal review was lodged within time. The only question about which the Privacy Commissioner advances submissions is the question of whether, if the internal review request was lodged out of time, it was nonetheless a competent application giving rise to review rights in the Tribunal in light of the respondent's 12 November 2012 letter.
Discussion
It is common ground that the Tribunal will have jurisdiction to deal with a matter if the application for internal review was lodged with the Respondent within 6 months from the time that ALZ became aware of the legal significance of the alleged conduct in the context of ALZ's rights under the PPIP Act.
Whether or not this was the case is an issue of fact to be determined on the evidence presented. The determinative issue is therefore whether or not ALZ's evidence is accepted.
In the circumstances, I accept ALZ's evidence that prior to 15 October 2012 she was not aware that she had an entitlement to seek an internal review from the Respondent. I accept that she was of the understanding that an exemption applied under the PPIP Act in regard to employee records. I also accept that advice that she received from her union organiser on 15 October 2012 prompted her to contact the Office of the Privacy Commissioner. Advice that she received from the Privacy Commissioner prompted her to make the privacy complaint. She made that complaint on 17 October 2012.
Accordingly, I find as a fact that ALZ made her application for internal review within the time prescribed under the PPIP Act.
That being the case, it is not necessary that I consider whether or not the way in which the Respondent initially dealt with ALZ's internal review application gives rise to an inference that the Respondent had exercised its discretion to accept the internal review application.
In my view, the Tribunal has jurisdiction to hear the matter as ALZ's application for internal review was made within the time prescribed under the PPIP Act.
I note that the Respondent has also raised the issue of inclusion in the application to the Tribunal of matters that were not the subject of the internal review application. As the Respondent has correctly noted, it is well established that the Tribunal has no jurisdiction to consider matters that were not the subject of the application for internal review.
The Respondent has also noted that to date it has not given any consideration to the merits of the first part of ALZ's internal review application and that it may be appropriate to remit the matter to the Respondent pursuant to section 65 of the ADT Act. I agree with that suggestion.
In the circumstances it is my view that the matter should be remitted for further consideration by the Respondent. Only matters that were the subject of the internal review application should be the subject of the further consideration. The further consideration is to be completed within 60 days from the date of these reasons.
The planning meeting listed for 16 July 2013 is vacated and the matter is listed instead at 10 am on Tuesday 10 September 2013.
Orders
1. The matter is remitted for further consideration by the Respondent pursuant to section 65 of the Administrative Decisions Tribunal Act 1997.
2. The further consideration is to be completed within 60 days from the date of these reasons.
3. The matter is listed for a further planning meeting at 10 am on Tuesday 10 September 2013.
**********
Decision last updated: 08 July 2013
0
0
2